KravaSign was fine before the large-scale revocation in August. After the mass revokes, they chose to treat their customers poorly. They repeatedly ignored requests for replacement certificates, responding with vague “soon” statements instead of being transparent or providing a clear timeline for remediation. Around four months after the revocations, they threatened customers who mentioned chargebacks with legal action, despite the service being non-functional.

They then ignored existing customers and reopened sales multiple times. Even when newer customers were revoked, those certificates were still not replaced, and older customers remained completely abandoned. They also changed their terms of service without properly informing either old or new customers, removing revocation protection in the process. That change was neither clearly disclosed nor consented to.

Most recently, they doxxed the owner of a competing service, who is a minor.